Hey all,
I am having a file that has the following stuff:
#9
#10
#4
#1
..
#6
For everything that is not #9 or #10, I already made a replacement and it shows #other for #4/#6, etc.
But when the statistics are shown, I am seeing the following order:
#10
#9
#other
I want to have the following output:
#9
#10
#other.
The search string i am using here is not providing the desired output:
index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*"
| eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other")
| top limit=0 Return_code_sent_to_SIL
| inputlookup append=true lookup_0_error_totals.csv
| stats max(count) as "Total errors" by Return_code_sent_to_SIL
| rename Return_code_sent_to_SIL as "#error"
| eval sort_Return_code_sent_to_SIL=case("#error"="#9",1, "#error"="#10",2, "#error"="#other",4) | sort by sort_Return_code_sent_to_SIL
What am I doing wrong?
Thanks!
Hi @jugarugabi,
Please try below;
index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*"
| eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other")
| top limit=0 Return_code_sent_to_SIL
| inputlookup append=true lookup_0_error_totals.csv
| stats max(count) as "Total errors" by Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL=replace(Return_code_sent_to_SIL,"#","")
| sort Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL="#".Return_code_sent_to_SIL
So I needed to remove the # there for the sorting to work out.
Thanks!
Hi @jugarugabi,
Please try below;
index = app_events_dbdetect_actimize_event_us_uat sourcetype = txndata Return_code_sent_to_SIL="#*"
| eval Return_code_sent_to_SIL=if(Return_code_sent_to_SIL="#9" OR Return_code_sent_to_SIL="#10", Return_code_sent_to_SIL, "#other")
| top limit=0 Return_code_sent_to_SIL
| inputlookup append=true lookup_0_error_totals.csv
| stats max(count) as "Total errors" by Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL=replace(Return_code_sent_to_SIL,"#","")
| sort Return_code_sent_to_SIL
| eval Return_code_sent_to_SIL="#".Return_code_sent_to_SIL